{"id":"ECHO-a40f-fcbc-6816","summary":"Out-of-bounds write of one or two bytes when the printf builtin (and\necho %b) converts a \\u or \\U Unicode escape into a multi-byte sequence.\n\ndash 0.5.12 has no \\u or \\U escapes. conv_escape() in src/bltin/printf.c\nhandles only \\\\ \\a \\b \\f \\n \\r \\t \\v and octal escapes; Debian's patch\n0008-Support-e-in-echo-and-printf-builtins adds \\e and nothing else. The\nUnicode-escape conversion arrived with upstream's \"dollar single quote\"\nwork and was first released in dash 0.5.13. Trixie ships 0.5.12-12.\n\nMUST re-evaluate if trixie moves dash to 0.5.13 or later.\n","modified":"2026-10-04T14:15:06.583959006Z","published":"2026-09-30T19:04:58.631Z","withdrawn":"2026-10-04T13:45:03.880Z","upstream":["CVE-2026-102474"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-102474"},{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-102474"}],"affected":[{"package":{"name":"dash","ecosystem":"Echo","purl":"pkg:deb/echo/dash"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.12-12"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-a40f-fcbc-6816.json"}}],"schema_version":"1.9.0"}